You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@roller.apache.org by sn...@apache.org on 2007/05/18 22:08:33 UTC
svn commit: r539585 -
/roller/branches/roller_3.1/web/WEB-INF/velocity/weblog.vm
Author: snoopdave
Date: Fri May 18 13:08:33 2007
New Revision: 539585
URL: http://svn.apache.org/viewvc?view=rev&rev=539585
Log:
Oops, we missed this comment field when we added XSS preventing escapeing
Modified:
roller/branches/roller_3.1/web/WEB-INF/velocity/weblog.vm
Modified: roller/branches/roller_3.1/web/WEB-INF/velocity/weblog.vm
URL: http://svn.apache.org/viewvc/roller/branches/roller_3.1/web/WEB-INF/velocity/weblog.vm?view=diff&rev=539585&r1=539584&r2=539585
==============================================================================
--- roller/branches/roller_3.1/web/WEB-INF/velocity/weblog.vm (original)
+++ roller/branches/roller_3.1/web/WEB-INF/velocity/weblog.vm Fri May 18 13:08:33 2007
@@ -176,7 +176,7 @@
<p class="comment-details">
$text.get("macro.weblog.postedby")
#if (!$utils.isEmpty($comment.name) && !$utils.isEmpty($comment.url))
- <a rel="nofollow" href="$comment.url"><b>$utils.escapeHTML($comment.name)</b></a>
+ <a rel="nofollow" href="$utils.escapeHTML($comment.url)"><b>$utils.escapeHTML($comment.name)</b></a>
#elseif (!$utils.isEmpty($comment.name))
<b>$utils.escapeHTML($comment.name)</b>
#elseif ($comment.remoteHost)